Never mind, Nginx was actually limiting requests correctly.

What I was seeing in my logs was requests for non-existent .js and .css files, which were then being passed to index.php as per my try_files in the / location block.